Malware › Module 6 › Lesson 1
Sandbox Hygiene
Isolated $MAL_LAB VM hygiene before dynamic analysis — snapshots, network containment, host separation, never daily-driver detonation.
Visual · t22_sandbox_hygiene
Sandbox hygiene = isolate before detonate. $MAL_LAB only. Original Cyberlium.
Opening
Dynamic analysis starts with a VM you can burn — not double-clicking unknown samples on your laptop because static looked boring.
Sandbox hygiene means preparing an isolated analysis environment before any sample touches a running system: dedicated $MAL_LAB VM with no shared folders to host OS, snapshot taken and named, network set to isolated or simulated-only per lab brief, clipboard and drag-drop disabled, analysis tools pre-installed, host antivirus aware but sample never on host filesystem. Malware analysts observe behavior in VMs they can revert — not on daily-driver Windows/macOS/Linux where email, banking, and employer data live. Cyberlium teaches hygiene checklist literacy on $MAL_LAB you control with legally obtained intentional samples — NOT detonating random USB finds on host OS, NOT bridging malware VLAN to home LAN, NOT 'quick peek' on work laptop. Validation = completed hygiene card before any dynamic step — stop if VM is not disposable or network leaks to production.
1. VM isolation basics
Dedicated $MAL_LAB VM: no production credentials, no OneDrive sync, no corporate VPN, snapshot label with UTC date.
Disable shared folders, clipboard, and USB passthrough unless brief explicitly requires controlled passthrough for analysis.
Command guide
Try these commands — VM isolation basics
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Dynamic analysis safety — https://malwareunicorn.org/workshops/malwareanalysis101.html (isolated VM only) ANY.RUN sandbox — https://any.run/ (use cloud sandbox — never host OS detonation)
═══ INSTALL ═══
Linux (Debian/Ubuntu): Built-in (iproute2)
macOS: Use: netstat
Windows: Use: netstat
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t22-mal/lab.env" 2>/dev/null || export LAB_HOST=${LAB_HOST:-127.0.0.1}
mkdir -p "$HOME/cyberlium-lab/t22-mal/notes"
python3 -c "print('REFUSE: detonation on host OS — baseline in lab VM only')"
ss -tulpn 2>/dev/null | head -15 | tee "$HOME/cyberlium-lab/t22-mal/notes/baseline-ss.txt"
grep -c LISTEN "$HOME/cyberlium-lab/t22-mal/notes/baseline-ss.txt" || wc -l "$HOME/cyberlium-lab/t22-mal/notes/baseline-ss.txt"Primary tools to practice this lesson: ss. Reference sites: Dynamic analysis safety (https://malwareunicorn.org/workshops/malwareanalysis101.html); ANY.RUN sandbox (https://any.run/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Network containment
Host-only or isolated VLAN for dynamic runs — fake DNS/INetSim optional per lab; never route $MAL_LAB straight to home LAN unfiltered.
Document egress policy: blocked, simulated, or logged sink — analyst knows where callbacks would go before detonation.
3. Host OS boundary
Samples stay inside $MAL_LAB disk — transfer via secure channel defined in lab brief, never 'just copy to Desktop' on host.
If hygiene fails mid-lab, revert snapshot and fix config — do not continue on contaminated daily driver.
4. What you ship: sandbox hygiene card
VM snapshot name + network mode + host separation checklist + NEVER daily-driver line.
5. What you record before the next lesson
Sandbox hygiene card path.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Detonate unknown sample on host OS because 'VM setup takes too long.'
Right
Hygiene card complete on $MAL_LAB. Next: Detonate Safely.
Mission: sandbox hygiene card
1) Name $MAL_LAB VM and snapshot. 2) Document network mode and egress policy. 3) List three host-separation rules. 4) Write NEVER daily-driver detonation line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Host-only vs isolated VLAN — which for my brief?”
Knowledge Check
APPLY: Sandbox hygiene on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Quick dynamic peek on host OS is acceptable.
True or False
Knowledge Check
APPLY: Before detonation you should:
Multiple choice